Equivalence between two-qubit entanglement and secure key distribution 



m 
o 
o 

(N 

Or 
D 

m : 
m : 

(N . 
m ■ 

> : 

m . 
in ■ 
o ■ 
cn : 
o . 
m ■ 
o ■ 

^ : 
Qk 
^— > ■ 
G ■ 
cd 

s : 
cr 



Antonio Acm 1 ' 2 , Lluis Masanes 3 and Nicolas Gisin 1 
1 GAP-Optique, University of Geneva, 20, Rue de I'Ecole de Medecine, CH-1211 Geneva 4, Switzerland 
2 Institut de Ciencies Fotdniques, Jordi Girona 29, Edifici Nexus II, 08034 Barcelona, Spain 
3 Dept. 



ECM, University of Barcelona, Diagonal 647, 08028 Barcelona, Spain 
(Dated: February 1, 2008) 

We study the problem of secret key distillation from bipartite states in the scenario where Alice and 
Bob can only perform measurements at the single-copy level and classically process the obtained 
outcomes. Even with these limitations, secret bits can be asymptotically distilled by the honest 
parties from any two-qubit entangled state, under any individual attack. Our results point out a 
complete equivalence between two-qubit entanglement and secure key distribution: a key can be 
established through a one-qubit channel if and only if it allows to distribute entanglement. These 
results can be generalized to higher dimension for all those states that are one-copy distillable. 

PACS numbers: 03.67.Dd, 03.65. Ud, 03.67.-a 



Quantum correlations or entanglement is the basic in- 
gredient for many applications of Quantum Information 
Theory By exploiting the correlations of entangled 
states, one can perform tasks that are impossible in Clas- 
sical Information Theory. Quantum cryptography Q, 
or more precisely quantum key distribution, is the most 
successful Quantum Information application, due to its 
experimental feasibility with present-day technology. Al- 
though entanglement is not required for a secure key dis- 
tribution [j| , there exist proposals using entangled states 
0. Indeed, it is unclear which role entanglement plays 
in quantum cryptography protocols. In this work, we 
analyze the problem of secret key extraction in the fol- 
lowing scenario: after a distribution stage, two honest 
parties, Alice and Bob, share a quantum state. This 
state is translated into a probability distribution by local 
measurements at the single-copy level, and the obtained 
outcomes are processed in order to distill a secret key. We 
denote by SIMCAP this Single-copy Measurements plus 
ClAssical Processing scenario. This is a common scenario 
in Quantum Information applications, where useful cor- 
relations are distributed between two or more parties by 
means of entangled states. For two-qubit systems and in- 
dividual attacks, we prove that Alice and Bob can distill 
a key by a SIMCAP protocol if and only if they initially 
share an entangled state. Thus, two-qubit entanglement 
is indeed equivalent to secure key distribution. 

Our result links the security of one-qubit channels with 
their entanglement capability. In the usual formulation of 
Quantum Cryptography, first a protocol for key distribu- 
tion is proposed and later possible eavesdropping attacks 
on it are analyzed. However, one can reverse this stan- 
dard presentation and, after specifying an eavesdropping 
attack, look for a secure key distribution protocol. This 
is indeed closer to what happens in a practical situation: 
the honest parties are connected by a given channel, de- 
noted by T, that is fixed and known. It depends on exper- 
imental parameters such as, for instance, dark counts or 
optical imperfections, and is the only non-local quantum 



resource Alice and Bob share. From the quantum cryp- 
tography point of view, it is conservatively assumed that 
Eve has total access to the channel. This means that the 
definition of the quantum channel is equivalent to specify 
Eve's interaction with the sent states. When does a given 
channel allow the honest parties to securely establish a 
secret key, in the SIMCAP scenario? Our results imply 
that a one-qubit channel is secure as soon as it allows 
entanglement distribution. For any entangling channel 
we show how to construct the corresponding SIMCAP 
key distillation protocol. Moving to higher dimension, 
our results immediately hold for all those bipartite states, 
and corresponding channels, that are one-copy distillable. 
Thus, they suggest a complete equivalence between dis- 
tillable entanglement and secure key distribution. 

Let us start with the simplest case of two qubits. A 
two-qubit entangled state is locally prepared by Alice 
and one of the two qubits is sent to Bob through a quan- 
tum channel. Since the channel is not perfect, Alice and 
Bob end with a two-qubit mixed state, pab §]■ They 
attribute the channel imperfections to the eavesdropper, 
Eve, who interacts with the sent qubits. We assume, as 
it is often done in many works on Quantum Cryptogra- 
phy, that Eve applies an individual attack: she lets inde- 
pendent auxiliary systems interact with each qubit and 
measures each system before the key extraction process 
||J. Since Eve has a perfect control on her interaction, 
the global state of the system is pure, \^abe)- The state 
shared by Alice and Bob is the one resulting from trac- 
ing out Eve, pab = tr e(\^ABe)(^ABe\)- The global 
pure state including Eve is, without loss of generality, 
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where \^abe) eC <g> C <gi C r , {n, \i)} define the spec- 
trum of pab , r is its rank and i e is an orthonormal basis 
on Eve's space. By computing the Schmidt decomposi- 
tion with respect to the partition AB — E, one can easily 



see that any other state \^abe) € C <8>C 
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d E > r, such that tr E {\^ abe){^ abe\) = Pab, is com- 
pletely equivalent to \^abe)- 

If pab is entangled, one can consider the following fully- 
quantum protocol for key distribution. The honest par- 
ties run a quantum distillation protocol pfl that trans- 
forms many copies of the initial mixed entangled state 
into fewer copies of a maximally entangled state ||. In 
this way, Eve becomes uncorrelated to Alice and Bob, 
who can safely measure in one basis, say z, and obtain 
the secret key. Note that in these protocols the honest 
parties must be able to perform quantum operations on 
several copies of their local states. This is in strong con- 
trast to the SIMCAP scenario where all the collective 
actions are performed at the classical level, while quan- 
tum physics is only used for the correlation distribution. 
Does this limit the possibility of distilling a key? 

It is worth to mention here that the experimental re- 
quirements for the SIMCAP protocols are definitely less 
stringent than for quantum distillation protocols. In par- 
ticular, no quantum memory is needed, avoiding decoher- 
ence problems. Moreover, our scenario reflects precisely 
what is feasible with current technology, in contrast to 
joint operations and quantum memories, that are impos- 
sible on a large scale even in the near future. 

Theorem: Consider the situation in which Alice and 
Bob share unlimited many instances of a two-qubit state, 
Pab- Under individual attacks, they can distill a secret 
key from them by measurements at the single-copy level 
and classical processing of the outcomes if and only if 
Pab is entangled. 

Proof: It was shown in that there exists a unique 
local filtering operation, Fa <8> Fb with F' a Fa < I2 and 
F b Fb < I2, mapping with some probability any two- 
qubit state into a state diagonal in a Bell basis 
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The local bases can be chosen such that |<I> + ) is the 
eigenvector associated to the largest eigenvalue, Ai = 
max({Aj}). This transformation maps entangled states 
into entangled Bell diagonal states |9|- After applying 
this filtering operation to pab, the honest parties share 
a Bell diagonal state (J2J), while the global state is 
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with Xi = y/Kj. Since the positivity of the partial trans- 
position is a necessary and sufficient condition for 

2 2 

separability in C ® C systems, p' AB is entangled iff 



Ai > A 2 + A 3 + A 4 = 1 - Ai. 



(4) 



After a successful local filtering, Alice and Bob mea- 
sure p' AB in the z basis, obtaining a partially correlated 



list of symbols, {ai} and {bi}. The measurements in the 
z basis terminate the measurement step in the SIMCAP 
distillation protocol, after which the original quantum 
state has been translated into a probability distribution 
[l2|. From Eq. ©, Eve's non-normalized states, \cab), 
depending on Alice and Bob's results are, where R = 0, 1, 
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Note that Eve knows in a deterministic way whether Al- 
ice and Bob differ in their measurement outcomes (which 
implies Iae = I be)- This happens with probability 
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which is Bob's error probability. 

In order to classically distill a key, Alice and Bob will 
now apply the advantage distillation protocol described 
in Ref. [l3J to their measurement outcomes. If the state 
is close to |$ + ), the mutual information between the 
honest parties, Iab, is larger than Eve's information, 
Ie = min(i^£, Ibe)- Then, no advantage distillation 
protocol is in principal required, since privacy amplifica- 
tion ^ij, a more efficient key distillation protocol, suf- 
fices. Nevertheless, we deal with advantage distillation 
protocols because they allow to extract a key even in sit- 
uations where Iab < Ie 15]. The advantage distillation 
protocol works as follows: if Alice wants to establish the 
bit x with Bob, she randomly takes N items from her list 
of symbols, a — (ai, 02, • ■ ■ , ajv), and sends to Bob the 
vector x such that ai+Xi = x mod 2, Vi = 1, . . . , N, plus 
the information about the chosen symbols. Bob com- 
putes bi + Xi, and whenever he obtains the same result, 
bi + Xi — y, y i, he accepts the bit. If not, the symbols are 
discarded and the process is repeated for a new vector of 
length N. Bob's error probability is now [l3| 
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that tends to an equality for N — > 00. 

Notice that for large N , x = y with very high probabil- 
ity. Hence we concentrate on the states \ei) = \eu) /\\eu\\, 
and denote Ei the corresponding projectors. Eve applies 
a generalized measurements (POVM) of M outcomes, 
J2i Mi = I2 with Mi > 0, trying to acquire informa- 
tion about these states. Indeed, since a is chosen at ran- 
dom, we assume Eve's measurement to be the same for all 
qubits without loosing generality. Moreover, any generic 
measurement can be seen as a measurement consisting 
of rank-one operators where some of the outcomes are 
later combined, so we can take Mi = |rnj)(mj|, Vi, with 
1 1 m^l I < 1. After the measurements, Eve uses all the 
information collected from the N symbols for guessing 
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x. From x, she knows that the bit string was equal to 
a = (a%, d2, • • ■ , aj\r) or to a? = (1 — 01, 1 — a?, . . . , 1 — ajv), 
corresponding to 1 — x. Independently of her decision 
strategy, there are instances where she will make an er- 
ror. For example, when the number of zeros in a is 
the same as the number of ones (the same holds for a'), 



and the number of times any measurement outcome has 
been obtained is the same for zeros and ones 0] . These 
events do not give her any information about x, so she 
is forced to guess and makes a mistake with probability 
1/2. Therefore, her error probability is bounded by 
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with 2^ i rii — N. The factor 1/2 N takes into account 
the number of possible vectors a, while the combinato- 
rial terms count the number of vectors satisfying our re- 
quirements. When N is large, one can approximate the 
combinatorial term (2rii)\ /(nil ) 2 ~ 2 2ni and then 

1 W M 

rii v 7 v ' 2—1 

(9) 

In the same limit, this sum is equal to 
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Since Mi are rank-one operators, 

M M 

V tr(E Q Mi)tr(EiMi) = ^ |<eo|Afijei>| > |(eo|ei)|, 

i=l t=l 

(11) 

where in the last step we used that {Mi} is a resolution 
of the identity. These equations imply that, for large N, 
Eve's error probability is bounded by an exponential term 
| (eo |ei) 1^ . This bound is tight: a simple measurement 
in the x (i.e. (|1) ± |4))/v2) basis attains it (see Fig. 
and the appendix). 

Now, Alice and Bob can establish a key whenever 

r ^-<IHe )| (12) 
1 - e B 

since then (see Eq. (|7|l) Bob's error probability decreases 
exponentially faster than Eve's, and this condition is 
known to be sufficient for key distillation 01 • More pre- 
cisely: if Eq. I|12l) is satisfied, there exists a finite N 
such that Alice and Bob, starting from the raw data and 
using this protocol, end with a smaller list of symbols 
where Iab > Ie- Then, they can apply privacy amplifi- 
cation techniques and distill a key. Using Eqs. © 
and jnj, condition Ijl2(l can be shown to be equivalent 
to Eq. Since Alice and Bob cannot establish a key 
when the state pab is separable [jgj. we conclude that 
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FIG. 1: Example of measurement attaining the bound of Eq. 
lllll . where the first outcome, [mo), is associated to 0, the 
second, |mi), symmetric to |mo) with respect to the z axis, 
to 1 and the third, |m?) = | + z), to an inconclusive result. 
The weight of |m?) is minimized. One can consider simi- 
lar three-outcome measurements, just changing the angle be- 
tween | mo), or [mi), and the z axis. All the measurements 
such that |mo) is between | + :r) and \e±) saturate the expo- 
nential bound. This does not mean that cen is the same for 
all of them. The limiting cases, [mo) = |e^-} and |mo) = \+x), 
correspond to the optimal measurements for unambiguous dis- 
crimination and for maximizing Eve's information. 

a secret key can be distilled in the SIMCAP scenario if 
and only if the initially shared state is entangled. □ 

Our results imply the equivalence between entangle- 
ment and security for qubit channels: if a one-qubit chan- 
nel, T, allows to distribute entanglement, key distribu- 
tion is possible. Indeed, this means that there exists a 
bipartite state, |$) € C 2 (£> C 2 , such that 

p2b = (12®T)(|$» (13) 

is entangled. Alice can then prepare the state |$) locally 
and send half of it to Bob through the noisy channel T. 
After this distribution stage, the honest parties run the 
presented SIMCAP protocol and distill a secret key from 
Pab- Two points deserve to be mentioned here. First, 
note that if one places the state preparation on Alice's 
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side, she can start with the state "as if it had passed 
her filter", i.e. Fa — i-2- And second, there is actu- 
ally no need of entanglement in the protocol. Indeed, 
it can be translated into an equivalent protocol without 
entanglement using the same ideas as in Ref. |3J. Alice's 
measurement can be incorporated into the state prepara- 
tion, before the state distribution [lit. Then, she sends 
through the channel, with probability 1/2, one of the two 
states \ip B ) £ C , defined as 

h^) = V2«±z|®l 2 )|$>. (14) 

Bob receives the states — T(\^pg)). He applies the 
filter Fb and measures in the z basis. Of course, the ob- 
tained probabilities are exactly the same as in the SIM- 
CAP protocol using |$), so Alice and Bob can securely 
distill a key without using any entanglement. 

For all the protocols, with and without entanglement, 
it is assumed that the channel is fixed. Note that for 
some channels, the states \tpg) may be orthogonal and 
form a basis. Eve could then replace her interaction by an 
intercept-resend attack: she measures in that basis and 
prepares a new state for Bob. But this would dramat- 
ically change the channel. Thus, Alice and Bob should 
randomly interrupt the key distribution and switch to a 
check stage where they monitor the channel. Entangle- 
ment is not required for this stage either. Those channels 
that do not allow to distribute entanglement are called 
entanglement breaking. They can be written as |2(lj 

T(|^))=^tr(L fe |^l)Pfe, (15) 
fe 

where pk are density matrices and {Lk} define a gen- 
eralized measurement, i.e. Lk > and ^2 k Lk = fl-2- 
From a cryptography point of view, this just represents 
an intercept-resend attack, as the one described above. 

To conclude, we have seen that, under arbitrary indi- 
vidual attacks, a secret key can be established in the SIM- 
CAP scenario if and only if the two-qubit state shared 
by Alice and Bob is entangled. This gives a one-to-one 
correspondence between two-qubit entanglement and se- 
cure key distribution: any one-qubit channel that is not 
entanglement breaking is secure. It would be interest- 
ing to extend our results to higher dimensional systems 
(some preliminary results can be found in Ref. [2l|). 
where there are entangled states, known as bound en- 
tangled [13], that are not quantum distillable. Our anal- 
ysis can be trivially extended to the so-called one-copy 
distillable states, those states for which there exist lo- 
cal projections onto two-dimensional subspaces such that 
the resulting two-qubit state is entangled. The honest 
parties should simply include these projections as a first 
step in the measurement part of the distillation proto- 
col. This fact suggests a complete equivalence between 
distillable entanglement and key distribution. According 
to it, the so-called entanglement binding channels, those 



channels thr oug h which only bound entanglement can be 
established (23|, would be useless for key distribution, 
although this remains unproven. A related open ques- 
tion is the conjectured existence of a classical anal og o f 
bound entanglement, known as bound information |l8| . 
that seems to appear in some probability distributions 
P(a, b, e) derived from bound entangled states. 
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Appendix: In this appendix we present several mea- 
surements strategies for Eve that attain the exponential 
bound of Eq. (JTJJ. For all these strategies, Eqs. ©, © 
and l|10fl become an equality in the limit of large N. In 
other words, the r.h.s. of these equations represent the 
relevant term of cen when N — ► oo. Thus, we only need 
to check Eq. I|llfl for the given measurements. 

First, consider a projective measurement in the x basis 
(see Fig. 0), i.e. M x = \ + x)(+x\ and M 2 = \- x)(-x\. 
This is the optimal measurement in terms of Eve's in- 
formation and error probability. Eve acquires informa- 
tion about x from all the N measurement outcomes. Al- 
though we are not interested in her decision strategy, she 
can associate | + x) (| — x)) to |eo) (|ei)) and then apply 
a majority rule for guessing x. It is now easy to see that 
(eo|Mi|ei) = (eo|M 2 |ei) > 0, and therefore the inequal- 
ity HI 1(1 is saturated by this measurement. 

A second possibility corresponds to the measurement 
optimizing Eve's probability of inconclusive result. It 
consists of three operators, M\ = c|e^ L )(ej L |, M 2 = 
c l e o X e o 1 an< i -^3 = °'- I + Note that if the first 

(second) outcome is obtained, Eve knows that the state 
was |eo) ( | ei ) ) with certainty, while she obtains no infor- 
mation from M3. The weights c and c? are chosen such 
that the probability of inconclusive result is minimized, 
giving p? = (e |M 3 |e ) = (ei|M 3 |ei) = | <e x je > |- In this 
case it is simple to compute 6en for all N. Knowing one 
of the symbols used in a plus the information in x allows 
Eve to deduce x. Only when she has obtained N incon- 
clusive results she is forced to guess, making a mistake 
in half of the cases. Then, her error probability reads 
e EN = i- 1 (ei |eo) 1^, which attains the bound. 

Finally, all the measurements interpolating in a coher- 
ent (or incoherent) way between these two strategies also 
attain the bound (see Fig. 0. Indeed it is simple to see 
that the inequality ((11(1 is saturated by all of them. Let 
us stress again here that this does not mean that cen is 
the same for all these measurements, but only that its 
exponential behavior goes like Keijeo)^ for large N, i.e. 
limAr^oo log cen = N log | (ei |e ) | . 
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